tomcat6-dta-ssl does not work with Tomcat 6.0.43

[Takeshi NISHIMURA]

Hi Charles,

Actually, we did specify sslProtocols/sslEnabledProtocols as below.
It works on Tomcat 6.0.41, but does not work on Tomcat 6.0.43.

> <Connector port="8443"
> ...
>            sslProtocols="TLSv1,TLSv1.1,TLSv1.2"
>            sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2"
> ...

Best regards,
Takeshi

On 2015/04/05 5:15, Charles R. Tompkins wrote:
> There was lots of SSLv3 dePOODLEing going on in tomcat 6.0.43:
> https://tomcat.apache.org/tomcat-6.0-doc/changelog.html
>
> Maybe the SOAP query is somehow negotiating SSLv3?
>
> You could try to specify your Connector "sslProtocols" directive with the TLS versions you feel comfortable with?
>
> -Charles
>
>
> -----Original Message-----
> From: Cantor, Scott [cantor.2 at osu.edu]
> Received: Saturday, 04 Apr 2015, 3:05PM
> To: Shib Users [users at shibboleth.net]
> Subject: Re: tomcat6-dta-ssl does not work with Tomcat 6.0.43
>
>
> On 4/4/15, 2:11 AM, "Takeshi NISHIMURA" <takeshi at nii.ac.jp> wrote:
>
>> Shibboleth IdPv2's tomcat6-dta-ssl does not seem to work with Tomcat 6.0.43.
>> In our environment, SAML Attribute Query always fails and the SP logs this error message.
>>
>> 2015-03-10 15:47:42 ERROR Shibboleth.AttributeResolver.Query [3]: exception during SAML query to https://...:8443/idp/profile/SAML1/SOAP/AttributeQuery: CURLSOAPTransport failed while contacting SOAP endpoint (https://...:8443/idp/profile/SAML1/SOAP/AttributeQuery): error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown
>> 2015-03-10 15:47:42 ERROR Shibboleth.AttributeResolver.Query [3]: unable to obtain a SAML response from attribute authority
>>
>> I think the signature change of getServerSocketFactory() would affect this issue.
>
> That seems like an odd result unless there's something clearly pointing to this in the Tomcat log, but you can certainly file a bug (V2 IdP project is fine, we don't have separate ones for the plugins).
>
> This is yet another example of why Tomcat should no longer be considered a good choice. Breaking an API in a patch release? Classic.
>
> -- Scott